alfi people Pty Ltd
How alfi protects patient data
Last reviewed: 26 September 2026
alfi people Pty Ltd builds software for Australian allied-health and disability service providers. Our apps use artificial intelligence to help clinicians and support workers with documentation, summaries and correspondence, which means they sometimes handle patient health information. Health information is sensitive information under the Privacy Act 1988 (Cth), and we treat it that way. This page explains, in plain language, what we do to protect it. Our full Privacy Policy sets out our obligations in detail.
Who is responsible for your information
The practice or service you attend collects and holds your health information and decides how it is used. alfi processes that information on the practice’s behalf, under contract, and only for the purposes the practice has agreed to. We never use patient information for our own purposes, and we never sell it.
Only what each task needs
Our apps do not hand whole patient files to the AI. Each feature is built to send only the specific information it needs for that task — a consultation note for a summary, a referral for a letter — and nothing more. Where a task doesn’t require your name or other identifiers, we remove them before the information is processed.
How we use AI
We use Claude, an AI model made by Anthropic, under a commercial agreement that prohibits Anthropic from using our data to train its models. Our production environment is configured for zero data retention, meaning Anthropic does not store the information our apps send or the responses it returns once a request is complete. Anthropic processes requests in the United States; the contractual and security safeguards covering that transfer are documented in our privacy impact assessments and summarised in our Privacy Policy.
The AI drafts. Your clinician decides. Anything the AI produces about you is reviewed by a health professional or support worker before it becomes part of your record or is acted on, and it is labelled as AI-generated so the source is always clear.
Where your information is stored
Records our apps hold — including any conversation history from AI features — are stored in Australia, encrypted at rest and in transit. Access is restricted to the practice staff authorised to see your record, and every access is logged. Conversation history is deleted after 12 months unless the practice needs it kept longer. Where an app sends a fax on a practice’s behalf, it goes through an Australian fax provider under contract.
Security
We apply the Australian Cyber Security Centre’s Essential Eight controls, use multi-factor authentication for all administrative access, and have our systems independently security-tested before they handle real patient data and at least annually after that. Our AI vendor holds ISO 27001 certification and SOC 2 Type II attestation, which we review each year. Our staff are trained on what information may and may not be entered into AI tools, and patient information is never used in any AI environment outside our controlled production system.
If something goes wrong
We maintain a data breach response plan under the Notifiable Data Breaches scheme. If a breach is likely to cause serious harm, we will work with the affected practice to notify you and the Office of the Australian Information Commissioner promptly.
Your rights
You can ask your practice to access or correct your health information at any time, including anything generated with the help of AI. If you have a question or concern about how alfi handles information, contact our Privacy Officer at privacy@alfi.com.au.
alfi manages personal information in accordance with the Australian Privacy Principles, including APP 1 (open and transparent management of personal information). Read our full Privacy Policy.
Last reviewed: 26 September 2026